Use Case Builder Implementation Guide

The Use Case builder contains tools to help you measure and track use cases through your automation journey, quickly autogenerate OOTB playbooks and custom workflows and more.

Setup And Configuration

To run this content you will need to setup the Cortex REST API integration. To do this, simply download and install the content from the marketplace, generate a api key, then add your api key to the instance (Choosing the standard authentication method.) Once that is complete, you can start using the Use Case Builder!

Default Incident Type

This Pack includes an Incident Type of 'Use Case Builder', which is the starting point for creating new Use Cases. To use this, navigate to the +New Incidents -> Select Type -> Use Case Builder+ and fill out the form to begin.

Layouts

The Use Case type has an optimized layout for both the summary pages, and the new/edit screen. This layout includes some useful information and dropdowns to kickstart your automation journey

Playbook

The default playbook is Use Case Builder, this playbook is performs alot of complex task and time consuming actions for you. At it's core the playbook simply does the following:

Provide important information to get you started.
Clones and Autogenerates playbooks based off your selections
Set SLAs and Timers for the development stages
Renders Markdown and HTML
Generates the Use Case Defintion Document
Evaluates XSOAR Usage and sets Adoption Metrics

Timers

Optionally this playbook has built in Timers for adding metrics for time spent In Development, Testing, Backlog, Production,etc.

Dashboards

This pack includes 1 dashboards:

Use Case Development Dashboard: High level summary of all Use Cases in Development and their associated metric data.

Dynamic Sections

There are Several Dynamic sections in this pack such as the Getting Started, Common Use Cases and Incident Flow section which are your guide to following XSOAR Best Practices and creating great use cases

Name	Description
CreateUseCaseStepsList
CreateUseCaseTemplateList
StopUseCaseDevelopmentTimer
PlaybookAutoGeneratorDynamicSectionMessage
GettingStartedWithXSOAR
UseCaseBuilderMarkdownToHTML	Converts Markdown to HTML.
UseCaseDevelopmentTimers
UseCaseAdoptionMetrics
UseCasePlaybookAutoGenerator
CreateXSOARIncidentFlowList
DeleteAndExcludeIndicators

Name	Description
Use Case Automation
Use Case Development Dashboard

Name	Description
Use Case SLAs
Use Case Builder Development Deadline
Use Case Purpose
Trigger
End-User Interactiveness
Use Case Builder Forensics and Malware Analysis
Use Case TIM Best Practice
Use Case Builder Email Gateway
Use Case Development Stage
Use Case Initiator	How is the incident created in XSOAR?
Use Case Name
Use Case Category	Select Use Case Category
Third Party Integrations
Use Case Testing Timer
Use Case Builder Network Security NGFW
Use Case Backlog Timer
Use Case Builder SEIM
Time to Triage
Use Case Ingestion Best Practice
Incident Response Process
Use Case Builder Playbook Generator Key
Use Case Builder Use Case Containment Steps
Use Case Type	Select from pre-built templates or Out-of-the-Box Use Cases
Incident Structure and Mapping
Use Case Design Best Practice
Use Case Builder Data Enrichment and Threat Intelligence
Customer Name
Use Case Priority
Use Case Builder IAM
XSOAR Incident Flow
Use Case Builder Auto Generator Key
Use Case Builder Getting Started
Use Case Required Metrics and Notifications
Manual Steps
Use Case Development Timer
Use Case Builder Authentication
Affected Host
CVE Reference Links
Deduplication Logic
Network Security IDS
Use Case Enrichment Steps
Enrichment
Use Case Pre-Production Timer
CVE Description
CVE Score
Use Case Production Timer
UseCaseAdoptionMetrics
Use Case Builder Endpoint
subclassification	For CMNG
Use Case Builder Case Management
Time to Remediate
Use Case Enrichment Actions
Use Case Builder Vulnerability Management
Custom Incident Data Structure
Time to Investigate

Name	Description
XSOAR Training
Use Case Builder
Quick Start Use Case

Name	Description
Create Use Case Template List	This Playbook creates the HTML Use Case Builder document list
Entity Enrichment - Generic v4	Enrich entities using one or more integrations.
Use Case Builder	The main playbook for the Use Case Builder
Create Use Case Steps List	This Playbook Creates the lists used in the Use Case Builder
Setting up the Use Case Builder Content	This playbook generates the flow, markdown, and layout information
Create XSOAR Incident Flow List	This playbooks creates the html process flow list
Generate Playbooks Based On Category	Takes the use case selected category and auto creates an example playbook
Use Case Builder Playbook Reset	This playbook resets the incident when the user chooses to start over.
Quick Start Main Playbook	The main playbook for the quick start incident
Quick Start Remediation	This contains the remediation and triage steps for the Quick Start Investigation
Generate Use Case Builder Lists	This playbook generates and saves the list types
Quick Start Investigation	This playbook contains the investigation steps in the Quick Start Playbook

Use Case Builder

Use Case Builder Implementation Guide

Setup And Configuration

Default Incident Type

Layouts

Playbook

Timers

Dashboards

Dynamic Sections

Scripts

UseCaseAdoptionMetrics

CreateUseCaseTemplateList

Scripts

UseCaseDevelopmentTimers

CreateUseCaseStepsList

GettingStartedWithXSOAR

CreateXSOARIncidentFlowList

StopUseCaseDevelopmentTimer

DeleteAndExcludeIndicators

PlaybookAutoGeneratorDynamicSectionMessage

Scripts

UseCaseBuilderMarkdownToHTML

Playbooks

Use Case Builder

Scripts

UseCasePlaybookAutoGenerator

Incident Fields

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Name	Description
Use Case Backlog Time
Use Cases in Development
Use Cases in Production
Use Case Time Spent in Testing
Time Spent in Pre-Production
Use Cases In Pre-Production
Total Use Cases
Use Cases On Track
Use Cases
Use Case time in Production
Use Cases in Testing
Use Case Development
Use Cases in Backlog

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Base	By: Cortex XSOAR
CaseManagement-Generic	By: Cortex XSOAR Customer Success
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Pack Name	Pack By
Rasterize	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Base	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
CaseManagement-Generic	By: Cortex XSOAR Customer Success
Common Scripts	By: Cortex XSOAR

Supported By	Community
Created	June 29, 2023
Last Release	November 20, 2024